diff --git a/src/http_keys.ml b/src/http_keys.ml
index 3406222d..ee3179fe 100644
--- a/src/http_keys.ml
+++ b/src/http_keys.ml
@@ -41,7 +41,7 @@ let denomgroup_of_denomdata
     RsaDenomGroup.
       { denoms; value; fee_withdraw; fee_deposit; fee_refresh; fee_refund }
 
-let mk_keys ~db_conn ~sm ~last_issue_date =
+let mk_keys ~db_conn (module Sm : Secmod.S) ~last_issue_date =
   let version = "0" in
   let base_url = Config.base_url in
   let currency = Config.currency in
@@ -121,7 +121,7 @@ let mk_keys ~db_conn ~sm ~last_issue_date =
     (* TODO
        use database signkey data / verify secmod and database are in sync *)
     (*let+ signkey_data_l = Pg.get_active_signkeys db_conn |> unwrap_err_caqti in*)
-    let signkey_data_l = Secmod.get_signkeys_data sm in
+    let signkey_data_l = Sm.get_signkeys_data () in
     let signkey_data_l =
       List.sort
         (fun a b ->
@@ -166,9 +166,7 @@ let mk_keys ~db_conn ~sm ~last_issue_date =
       |> Bin_type.Hash_64.hash
     in
     let open Bin_sig.ExchangeKeySet in
-    sign_f
-      ~f:(Secmod.sign_with_signkey sm ~pub:exchange_pub)
-      R.{ list_issue_date; hc }
+    sign_f ~f:(Sm.sign_with_signkey ~pub:exchange_pub) R.{ list_issue_date; hc }
   in
 
   let recoup = [] in
@@ -223,7 +221,7 @@ let f req server _env =
   let sm = Vif.Server.device Devices.secmod server in
   let res =
     let last_issue_date = Ptime_clock.now () |> Option.some in
-    let* v = mk_keys ~db_conn ~sm ~last_issue_date in
+    let* v = mk_keys ~db_conn sm ~last_issue_date in
     let s = Api.encode_exn jsont v in
     Ok s
   in
diff --git a/src/http_management.ml b/src/http_management.ml
index 11855612..cb4e414c 100644
--- a/src/http_management.ml
+++ b/src/http_management.ml
@@ -189,15 +189,15 @@ module Keys_post = struct
       signkey_sigs
       |> List.map (fun SignKeySignature.{ key; master_sig } ->
           (key, master_sig))
-      |> Sm.add_signkey_master_signatures db_conn
+      |> Sm.add_signkey_master_signatures
     in
     let* () =
       denom_sigs
       |> List.map (fun DenomSignature.{ h_denom_pub; master_sig } ->
           (h_denom_pub, master_sig))
-      |> Secmod.add_denom_master_signatures db_conn sm
+      |> Sm.add_denom_master_signatures
     in
-    let* () = check_master_signatures_update ~db_conn ~sm in
+    let* () = check_master_signatures_update ~db_conn (module Sm) in
     Ok ()
 
   let jsont = MasterSignatures.jsont
@@ -208,20 +208,22 @@ module Keys_post = struct
     let sm = Vif.Server.device Devices.secmod server in
     let res =
       let* v = Vif.Request.of_json req |> unwrap_err_msg in
-      let* () = verify ~sm v in
-      let* () = do_ ~db_conn ~sm v in
+      let* () = verify sm v in
+      let* () = do_ ~db_conn sm v in
       Ok ""
     in
     Respond_util.respond_with_res res req
 end
 
 module Denom_revoke = struct
-  let verify h_denom_pub DenomRevocationSignature.{ master_sig } =
+  let verify (module Sm : Secmod.S) h_denom_pub
+      DenomRevocationSignature.{ master_sig } =
     let open Bin_sig.MasterDenominationKeyRevocation in
-    verify_f ~f:Secmod.verify_with_master_key master_sig { h_denom_pub }
+    verify_f ~f:Sm.verify_with_master_key master_sig { h_denom_pub }
 
-  let do_ ~db_conn ~sm h_denom_pub DenomRevocationSignature.{ master_sig } =
-    let* () = Secmod.revoke_denomination sm h_denom_pub master_sig in
+  let do_ ~db_conn (module Sm : Secmod.S) h_denom_pub
+      DenomRevocationSignature.{ master_sig } =
+    let* () = Sm.revoke_denomination h_denom_pub master_sig in
     let+ () =
       Pg.insert_denomination_revocation db_conn h_denom_pub master_sig
       |> unwrap_err_caqti
@@ -237,20 +239,22 @@ module Denom_revoke = struct
     let res =
       let* h_denom_pub = DenominationHash.of_b32 h_denom_pub in
       let* v = Vif.Request.of_json req |> unwrap_err_msg in
-      let* () = verify h_denom_pub v in
-      let* () = do_ ~db_conn ~sm h_denom_pub v in
+      let* () = verify sm h_denom_pub v in
+      let* () = do_ ~db_conn sm h_denom_pub v in
       Ok ""
     in
     Respond_util.respond_with_res res req
 end
 
 module Signkey_revoke = struct
-  let verify exchange_pub SignkeyRevocationSignature.{ master_sig } =
+  let verify (module Sm : Secmod.S) exchange_pub
+      SignkeyRevocationSignature.{ master_sig } =
     let open Bin_sig.MasterSigningKeyRevocation in
-    verify_f ~f:Secmod.verify_with_master_key master_sig { exchange_pub }
+    verify_f ~f:Sm.verify_with_master_key master_sig { exchange_pub }
 
-  let do_ ~db_conn ~sm exchange_pub SignkeyRevocationSignature.{ master_sig } =
-    let* () = Secmod.revoke_signkey sm exchange_pub master_sig in
+  let do_ ~db_conn (module Sm : Secmod.S) exchange_pub
+      SignkeyRevocationSignature.{ master_sig } =
+    let* () = Sm.revoke_signkey exchange_pub master_sig in
     let+ () =
       Pg.insert_signkey_revocation db_conn exchange_pub master_sig
       |> unwrap_err_caqti
@@ -266,15 +270,15 @@ module Signkey_revoke = struct
     let res =
       let* exchange_pub = Crypto.EddsaPublicKey.of_b32 exchange_pub in
       let* v = Vif.Request.of_json req |> unwrap_err_msg in
-      let* () = verify exchange_pub v in
-      let* () = do_ ~db_conn ~sm exchange_pub v in
+      let* () = verify sm exchange_pub v in
+      let* () = do_ ~db_conn sm exchange_pub v in
       Ok ""
     in
     Respond_util.respond_with_res res req
 end
 
 module Auditors = struct
-  let verify
+  let verify (module Sm : Secmod.S)
       AuditorSetupMessage.
         {
           auditor_url;
@@ -284,7 +288,7 @@ module Auditors = struct
           validity_start;
         } =
     let open Bin_sig.MasterAddAuditor in
-    verify_f ~f:Secmod.verify_with_master_key master_sig
+    verify_f ~f:Sm.verify_with_master_key master_sig
       {
         start_date= validity_start;
         auditor_pub;
@@ -315,10 +319,11 @@ module Auditors = struct
 
   let f req server _env =
     Logs.info (fun m -> m "POST /management/auditors/");
+    let sm = Vif.Server.device Devices.secmod server in
     let db_conn = Vif.Server.device Devices.db_connection server in
     let res =
       let* v = Vif.Request.of_json req |> unwrap_err_msg in
-      let* () = verify v in
+      let* () = verify sm v in
       let* () = do_ ~db_conn v in
       Ok ""
     in
@@ -326,9 +331,10 @@ module Auditors = struct
 end
 
 module Auditors_disable = struct
-  let verify auditor_pub AuditorTeardownMessage.{ master_sig; validity_end } =
+  let verify (module Sm : Secmod.S) auditor_pub
+      AuditorTeardownMessage.{ master_sig; validity_end } =
     let open Bin_sig.MasterDelAuditor in
-    verify_f ~f:Secmod.verify_with_master_key master_sig
+    verify_f ~f:Sm.verify_with_master_key master_sig
       { end_date= validity_end; auditor_pub }
 
   let do_ ~db_conn auditor_pub
@@ -352,11 +358,12 @@ module Auditors_disable = struct
 
   let f req auditor_pub server _env =
     Logs.info (fun m -> m "POST /management/auditors/$AUDITOR_PUB/revoke/");
+    let sm = Vif.Server.device Devices.secmod server in
     let db_conn = Vif.Server.device Devices.db_connection server in
     let res =
       let* auditor_pub = Crypto.EddsaPublicKey.of_b32 auditor_pub in
       let* v = Vif.Request.of_json req |> unwrap_err_msg in
-      let* () = verify auditor_pub v in
+      let* () = verify sm auditor_pub v in
       let* () = do_ ~db_conn auditor_pub v in
       Ok ""
     in
@@ -364,7 +371,7 @@ module Auditors_disable = struct
 end
 
 module Wire_fee = struct
-  let verify
+  let verify (module Sm : Secmod.S)
       WireFeeSetupMessage.
         {
           wire_method;
@@ -375,7 +382,7 @@ module Wire_fee = struct
           wire_fee;
         } =
     let open Bin_sig.MasterWireFee in
-    verify_f ~f:Secmod.verify_with_master_key master_sig_wire
+    verify_f ~f:Sm.verify_with_master_key master_sig_wire
       {
         h_wire_method= Bin_type.Hash_64_cstr.hash wire_method;
         start_date= fee_start;
@@ -400,10 +407,11 @@ module Wire_fee = struct
 
   let f req server _env =
     Logs.info (fun m -> m "POST /management/wire-fee/");
+    let sm = Vif.Server.device Devices.secmod server in
     let db_conn = Vif.Server.device Devices.db_connection server in
     let res =
       let* v = Vif.Request.of_json req |> unwrap_err_msg in
-      let* () = verify v in
+      let* () = verify sm v in
       let* () = do_ ~db_conn v in
       Ok ""
     in
@@ -411,7 +419,7 @@ module Wire_fee = struct
 end
 
 module Global_fees = struct
-  let verify
+  let verify (module Sm : Secmod.S)
       GlobalFees.
         {
           start_date;
@@ -433,7 +441,7 @@ module Global_fees = struct
     let kyc_fee = dummy_amount in
     (* * *)
     let open Bin_sig.GlobalFees in
-    verify_f ~f:Secmod.verify_with_master_key master_sig
+    verify_f ~f:Sm.verify_with_master_key master_sig
       {
         start_date;
         end_date;
@@ -464,10 +472,11 @@ module Global_fees = struct
 
   let f req server _env =
     Logs.info (fun m -> m "POST /management/global-fees/");
+    let sm = Vif.Server.device Devices.secmod server in
     let db_conn = Vif.Server.device Devices.db_connection server in
     let res =
       let* v = Vif.Request.of_json req |> unwrap_err_msg in
-      let* () = verify v in
+      let* () = verify sm v in
       let* () = do_ ~db_conn v in
       Ok ""
     in
@@ -475,7 +484,7 @@ module Global_fees = struct
 end
 
 module Wire = struct
-  let verify
+  let verify (module Sm : Secmod.S)
       WireSetupMessage.
         {
           payto_uri;
@@ -492,7 +501,7 @@ module Wire = struct
     let open Bin_type in
     let* () =
       let open Bin_sig.MasterWireDetails in
-      verify_f ~f:Secmod.verify_with_master_key master_sig_wire
+      verify_f ~f:Sm.verify_with_master_key master_sig_wire
         {
           h_wire_details= FullPaytoHash.hash payto_uri;
           h_conversion_url= Hash_64_cstr.hash conversion_url;
@@ -502,7 +511,7 @@ module Wire = struct
     in
     let* () =
       let open Bin_sig.MasterAddWire in
-      verify_f ~f:Secmod.verify_with_master_key master_sig_add
+      verify_f ~f:Sm.verify_with_master_key master_sig_add
         {
           start_date= validity_start;
           h_wire= FullPaytoHash.hash payto_uri;
@@ -542,10 +551,11 @@ module Wire = struct
 
   let f req server _env =
     Logs.info (fun m -> m "POST /management/wire/");
+    let sm = Vif.Server.device Devices.secmod server in
     let db_conn = Vif.Server.device Devices.db_connection server in
     let res =
       let* v = Vif.Request.of_json req |> unwrap_err_msg in
-      let* () = verify v in
+      let* () = verify sm v in
       let* () = do_ ~db_conn v in
       Ok ""
     in
@@ -553,9 +563,10 @@ module Wire = struct
 end
 
 module Wire_disable = struct
-  let verify WireTeardownMessage.{ payto_uri; master_sig_del; validity_end } =
+  let verify (module Sm : Secmod.S)
+      WireTeardownMessage.{ payto_uri; master_sig_del; validity_end } =
     let open Bin_sig.MasterDelWire in
-    verify_f ~f:Secmod.verify_with_master_key master_sig_del
+    verify_f ~f:Sm.verify_with_master_key master_sig_del
       { end_date= validity_end; h_wire= Bin_type.FullPaytoHash.hash payto_uri }
 
   let do_ ~db_conn
@@ -575,10 +586,11 @@ module Wire_disable = struct
 
   let f req server _env =
     Logs.info (fun m -> m "POST /management/wire/disable/");
+    let sm = Vif.Server.device Devices.secmod server in
     let db_conn = Vif.Server.device Devices.db_connection server in
     let res =
       let* v = Vif.Request.of_json req |> unwrap_err_msg in
-      let* () = verify v in
+      let* () = verify sm v in
       let* () = do_ ~db_conn v in
       Ok ""
     in
@@ -586,7 +598,7 @@ module Wire_disable = struct
 end
 
 module Drain = struct
-  let verify
+  let verify (module Sm : Secmod.S)
       DrainProfitsMessage.
         {
           debit_account_section;
@@ -598,7 +610,7 @@ module Drain = struct
         } =
     let open Bin_sig.MasterDrainProfit in
     let open Bin_type in
-    verify_f ~f:Secmod.verify_with_master_key master_sig
+    verify_f ~f:Sm.verify_with_master_key master_sig
       {
         wtid;
         date;
@@ -615,10 +627,11 @@ module Drain = struct
 
   let f req server _env =
     Logs.info (fun m -> m "POST /management/drain/");
+    let sm = Vif.Server.device Devices.secmod server in
     let db_conn = Vif.Server.device Devices.db_connection server in
     let res =
       let* v = Vif.Request.of_json req |> unwrap_err_msg in
-      let* () = verify v in
+      let* () = verify sm v in
       let* () = do_ ~db_conn v in
       Ok ""
     in
@@ -626,7 +639,7 @@ module Drain = struct
 end
 
 module AmlOfficer = struct
-  let verify
+  let verify (module Sm : Secmod.S)
       AmlOfficerSetup.
         {
           officer_pub;
@@ -638,7 +651,7 @@ module AmlOfficer = struct
         } =
     let open Bin_sig.MasterAmlOfficerStatus in
     let is_active = match is_active with true -> 1_l | false -> 0_l in
-    verify_f ~f:Secmod.verify_with_master_key master_sig
+    verify_f ~f:Sm.verify_with_master_key master_sig
       {
         change_date;
         officer_pub;
@@ -654,10 +667,11 @@ module AmlOfficer = struct
 
   let f req server _env =
     Logs.info (fun m -> m "POST /management/aml-officers/");
+    let sm = Vif.Server.device Devices.secmod server in
     let db_conn = Vif.Server.device Devices.db_connection server in
     let res =
       let* v = Vif.Request.of_json req |> unwrap_err_msg in
-      let* () = verify v in
+      let* () = verify sm v in
       let* () = do_ ~db_conn v in
       Ok ""
     in
@@ -665,7 +679,7 @@ module AmlOfficer = struct
 end
 
 module Partners = struct
-  let verify
+  let verify (module Sm : Secmod.S)
       ExchangePartnerSetupRequest.
         {
           partner_base_url;
@@ -677,7 +691,7 @@ module Partners = struct
           wad_fee;
         } =
     let open Bin_sig.PartnerConfiguration in
-    verify_f ~f:Secmod.verify_with_master_key master_sig
+    verify_f ~f:Sm.verify_with_master_key master_sig
       {
         partner_pub;
         start_date;
@@ -695,10 +709,11 @@ module Partners = struct
 
   let f req server _env =
     Logs.info (fun m -> m "POST /management/partners/");
+    let sm = Vif.Server.device Devices.secmod server in
     let db_conn = Vif.Server.device Devices.db_connection server in
     let res =
       let* v = Vif.Request.of_json req |> unwrap_err_msg in
-      let* () = verify v in
+      let* () = verify sm v in
       let* () = do_ ~db_conn v in
       Ok ""
     in